Legal
Data processing addendum (beta)
Template addendum for beta workspaces, within the meaning of Article 28 GDPR. A tailored agreement can be requested.
Last updated: 26 October 2026
1. Subject matter and scope
Workspaces are designed to receive no personal data: only labels, decisions and confidence levels are accepted, and every field is length-capped. This addendum nevertheless applies if, despite that prohibition, personal data were present in the data sent.
The customer is the organisation that owns the workspace. The provider is: Théo Coutard, individual (experimental project, no commercial activity to date), not registered, 4 rue des pinsons, 44115 Haute-Goulaine, France — theo@correlationindex.xyz.
2. Roles
For this data, the customer is the controller and the provider is the processor. For account data (email address, password), the provider is the controller: see the privacy policy.
3. Description of the processing
| Item | Description |
|---|---|
| Nature | Hosting, storage, computing agreement indicators, export, deletion |
| Purpose | Provide the customer with the agreement analysis across the AI models of its systems |
| Duration | While the workspace exists; decisions kept for a rolling 24 months; audit trail 12 months |
| Data | System labels, model families, scenario references, decisions (short label), confidence, dates, idempotency identifiers. No personal data intended. |
| Data subjects | None intended. In case of accidental inclusion: the people whose data the customer included. |
4. Instructions and confidentiality
The provider processes the data only on the customer's documented instructions, that is, the use of the service's features and this addendum. It informs the customer if it believes an instruction infringes applicable law. Persons authorised to access the data are bound by confidentiality.
5. Security (Art. 32)
- Encrypted connections (HTTPS) and encryption at rest by the database host.
- Per-organisation isolation: row-level access rules; no direct write access for customers; writes through audited functions.
- Random 256-bit API keys, stored only as a fingerprint; revocable at any time.
- Minimisation: length-capped fields, any unknown field rejected, including any raw-text field.
- Audit trail of creations, revocations, sends and reads (without content).
- Per-key rate limits; restricted administrator access.
6. Sub-processors
The customer gives general authorisation for these sub-processors. The provider informs the customer of any addition or replacement before it takes effect, so the customer can object or delete its workspace.
| Sub-processor | Role | Location |
|---|---|---|
| Supabase | Database and authentication | Ireland (AWS eu-west-1, European Union) |
| Vercel Inc. | Application and API hosting | Functions run in Paris; company established in the United States |
7. Assistance, breaches, transfers
The provider assists the customer, as far as possible, in responding to data-subject requests and in meeting its security, impact-assessment and notification obligations.
The provider notifies the customer of any personal data breach affecting it without undue delay after becoming aware of it, with the information available.
Any transfers outside the European Union (host established in the United States) must rely on the safeguards provided for by the GDPR; they are checked with each sub-processor.
8. End, audit, liability
At the end of the service or on request, the customer exports its data and deletes the workspace, which erases the data and the audit trail; the provider keeps no copy, apart from the host's technical backups, which are erased on their own cycle.
The provider makes available the information needed to demonstrate compliance with this addendum and accepts reasonable audit requests, made with notice and respecting confidentiality.
Liability is governed by the terms of use. This addendum is governed by French law.
9. Contact
theo@correlationindex.xyz